CVE-2024-36066 Weak cryptography in n/a
The EJBCA CMP CLI client uses insufficient salt length, weakening password-based MAC and facilitating man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-36066?
CVE-2024-36066 is a low-severity vulnerability in n/a, published on 12 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier. CMP includes password-based MAC as one of the options for message integrity and authentication (the other option is certificate-based). RFC 4211 section 4.4 requires that password-based MAC parameters use a salt with a random value of at least 8 octets. This helps to inhibit dictionary attacks. Because the standalone CMP client originally was developed as test code, the salt was instead hardcoded and only 6 octets long.
Which versions are affected by CVE-2024-36066?
It affects 1 product.
Products include Keyfactor Ejbca.
How do I fix CVE-2024-36066?
No fix has been published for CVE-2024-36066 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-36066 being exploited?
There is no known exploitation of CVE-2024-36066 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xmrg-69jq-mfv5.